Listen to this Post
Introduction:
The Cybersecurity and Infrastructure Security Agency (CISA) has added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation across macOS, Microsoft SharePoint, VMware vCenter, and Microsoft Internet Key Exchange (IKE) Service Extensions. With CVSS scores ranging from 9.1 to 9.8, these flaws target foundational enterprise infrastructure layers—operating systems, collaboration platforms, virtualization management planes, and network authentication protocols. What makes this advisory particularly alarming is the diversity of attack vectors: cryptocurrency mining, AI-enabled autonomous hacking campaigns, suspected China-1exus APT activity deploying reverse_ssh backdoors, and ransomware deployment. As of this reporting, 361 unique victim IP addresses across 47 countries have been compromised, with the highest concentrations in Germany, the United States, Turkey, Iran, and France. The geographic spread underscores how rapidly exploitation accelerates once proof-of-concept (PoC) code emerges or nation-state actors weaponize newly disclosed flaws.
Learning Objectives & Secrets:
- Objective 1: Understand the technical root cause and exploitation mechanics of each CVE—from macOS Screen Sharing’s SRP state-machine bypass to SharePoint’s JWT `alg:none` token forgery, vCenter’s syslog directory traversal, and Windows IKE’s double-free memory corruption.
-
Objective 2 (Secret Tip): Prioritize detection over reaction—review authentication logs for `screensharingd` connections on TCP 5900 without prior credential exchanges; monitor SharePoint for JWT tokens with `alg:none` headers and non-verified signatures; audit vCenter `/var/log/` for unexpected cron jobs and `reverse_ssh` binaries; inspect Windows event logs for malformed IKE packets on UDP 500/4500.
-
Objective 3 (Secret Tip): Patch windows are closing rapidly. CISA mandates Federal Civilian Executive Branch (FCEB) agencies update vulnerable systems by August 21, 2026, under BOD 26-04. Organizations outside the federal enterprise should treat this deadline as a minimum—attackers are not waiting.
You Should Know:
- CVE-2026-65400 — macOS Screen Sharing Authentication Bypass (CVSS 9.8)
The vulnerability resides in screensharingd—the daemon behind macOS Screen Sharing and Apple Remote Management, listening on TCP port 5900. The daemon’s native authentication path uses Secure Remote Password (SRP). A frame-length validator returns a stale success status, marking the connection as authenticated before any credential is verified. Apple’s advisory language—”improved state management”—confirms the cryptography was never broken; the state machine around it was.
Observed Exploitation: Attackers are delivering the XMRig 6.26.0 Monero cryptocurrency miner. Post-exploitation activity includes SSH public key persistence, log and shell history clearing, and packet filter rule modification.
Affected Versions:
- macOS Tahoe 26 ≤ 26.6 → Fixed in 26.6.1
- macOS Sequoia 15 ≤ 15.7.8 → Fixed in 15.7.9
- macOS Sonoma 14 ≤ 14.8.8 → Fixed in 14.8.9
Detection & Hardening Commands:
Check if Screen Sharing is enabled and listening:
macOS - Check if Screen Sharing is enabled sudo systemsetup -getremotelogin sudo launchctl list | grep screensharing Check for listening port 5900 sudo lsof -i :5900 sudo netstat -an | grep 5900
Audit for unauthorized access or miner activity:
Check for XMRig or other mining processes ps aux | grep -i xmrig ps aux | grep -i miner Review authentication logs for Screen Sharing anomalies log show --predicate 'subsystem == "com.apple.screensharing"' --last 7d Check for unauthorized SSH keys cat ~/.ssh/authorized_keys sudo cat /var/root/.ssh/authorized_keys
Remediation: Apply macOS updates immediately. If patching is delayed, block inbound TCP 5900 at the network perimeter for systems where Screen Sharing is not required.
- CVE-2026-55040 — Microsoft SharePoint JWT Authentication Bypass (CVSS 9.1)
This vulnerability resides in SharePoint’s `SPJsonWebSecurityTokenHandlerV2` and `SPJsonWebSecurityBaseTokenHandlerV2` classes—the components responsible for validating JSON Web Tokens (JWTs) presented to the authentication pipeline. Rapid7 researchers discovered that the validation logic chains four distinct weaknesses to allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user or administrator:
- Attacker sends a JWT with `alg: none` in the outer header, so no signature is required.
- The token’s `x5t` header contains SharePoint’s own STS certificate thumbprint, allowing key resolution without verification.
- The resolved certificate is not in
TrustedSecurityTokenServices, enabling issuer acceptance. - The token’s signature is a non-empty value (e.g.,
AAAA) that is never verified.
Observed Exploitation: Unknown actors leveraging publicly released Rapid7 PoC code. Telemetry shows 12 exploitation attempts since July 19, 2026, with eight occurring on August 12–13—immediately following PoC release.
Affected Versions:
- Microsoft SharePoint Enterprise Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition
Detection & Hardening Commands:
Audit SharePoint for JWT authentication anomalies (PowerShell):
Check SharePoint ULS logs for JWT validation errors
Get-SPLogEvent | Where-Object { $_.Message -match "JWT|token|authentication" } |
Select-Object TimeStamp, Area, Category, Message
Review IIS logs for suspicious Bearer tokens
Get-Content "C:\inetpub\logs\LogFiles\W3SVC.log" |
Select-String "Bearer" -Context 2,2
Check for unauthorized admin activity
Get-SPUser -Web https://your-sharepoint-site |
Where-Object { $_.IsSiteAdmin -eq $true }
SharePoint-specific log review:
Query Unified Logging Service (ULS) for token validation failures Merge-SPLogFile -Path "C:\temp\sharepoint_logs.log" -Overwrite Select-String -Path "C:\temp\sharepoint_logs.log" -Pattern "CVE-2026-55040|JWT|SPJsonWebSecurity"
Remediation: Apply Microsoft’s July 2026 Patch Tuesday updates (KB5002882, KB5002883, KB5002891). No workaround exists—patching is the only effective remediation.
- CVE-2026-59310 — VMware vCenter Path Traversal (CVSS 9.8)
A directory traversal vulnerability in the vCenter Syslog service allows an unauthenticated attacker with network access to manipulate file paths, write files outside their intended directory, and achieve arbitrary code execution on the vCenter appliance. Broadcom disclosed the flaw in advisory VMSA-2026-0006 on July 29, 2026.
Observed Exploitation: Suspected China-1exus APT actors. Attackers use path traversal to write and execute arbitrary code, then plant cron jobs launching reverse_ssh—an open-source reverse-shell framework establishing outbound command-and-control channels that evade inbound-traffic defenses. In at least one case, the campaign escalated to Babuk-derived ransomware deployment. QUIRSO GmbH identified live exploitation beginning August 3, 2026—just five days after disclosure.
Affected Versions: Broadcom has confirmed no workaround exists.
Detection & Hardening Commands:
Audit vCenter for unauthorized binaries and cron jobs (SSH into vCenter appliance):
Check for reverse_ssh binaries find / -1ame "reverse_ssh" -type f 2>/dev/null find /tmp /var/tmp /dev/shm -type f -executable -ls 2>/dev/null Review cron jobs for persistence crontab -l cat /etc/crontab ls -la /etc/cron.d/ ls -la /etc/cron.daily/ ls -la /etc/cron.hourly/ Check for unexpected outbound connections ss -tunap | grep ESTAB netstat -tunap | grep ESTAB Review vCenter Syslog for path traversal indicators grep -i "..\/" /var/log/vmware/ grep -i "directory traversal" /var/log/vmware/ Check for unauthorized SSH reverse tunnels ps aux | grep -i "ssh -R" lsof -i | grep -i ssh
Remediation: Apply fixed builds—vCenter 9.1.0.0300, 9.0.2.0100, or 8.0 U3k/U2f. No workaround exists. If patching is delayed, restrict network access to vCenter management interfaces and implement strict network segmentation.
- CVE-2026-33824 — Microsoft IKE Service Extensions Double-Free (CVSS 9.8)
A double-free vulnerability (CWE-415) in the Windows Internet Key Exchange (IKE) Service Extensions component. An unauthenticated attacker can gain remote code execution by sending maliciously crafted packets to unpatched Windows systems through UDP ports 500 or 4500.
Observed Exploitation: According to Palo Alto Networks Unit 42, a Chinese-speaking threat actor is exploiting this flaw as part of an AI-enabled autonomous hacking campaign using DeepSeek, simultaneously conducting manual operations leveraging known vulnerabilities.
Affected Versions: All supported Windows 10, Windows 11, and Windows Server releases.
Detection & Hardening Commands:
Check if IKE service is exposed and listening:
PowerShell - Check IKE service status
Get-Service -1ame "IKEv2" | Select-Object Name, Status, StartType
Check for listening UDP ports 500 and 4500
netstat -an | findstr ":500 "
netstat -an | findstr ":4500 "
Review Windows event logs for IKE-related errors
Get-WinEvent -LogName "System" | Where-Object { $_.Message -match "IKE|IKEEXT|4500|500" } |
Select-Object TimeCreated, Id, Message -First 50
Check for malformed packet indicators (Event ID 501)
Get-WinEvent -LogName "Security" -FilterXPath "[System[EventID=501]]" |
Select-Object TimeCreated, Message
Network-level protection (if patching delayed):
Block inbound UDP 500 and 4500 via Windows Firewall New-1etFirewallRule -DisplayName "Block IKE UDP 500" -Direction Inbound -Protocol UDP -LocalPort 500 -Action Block New-1etFirewallRule -DisplayName "Block IKE UDP 4500" -Direction Inbound -Protocol UDP -LocalPort 4500 -Action Block Allow only from known peer addresses if IKE is required New-1etFirewallRule -DisplayName "Allow IKE from trusted peers" -Direction Inbound -Protocol UDP -LocalPort 500 -RemoteAddress "192.168.1.0/24" -Action Allow
Linux-based network monitoring for IKE exploitation attempts:
Monitor for malformed IKE packets (tcpdump) sudo tcpdump -i any udp port 500 or udp port 4500 -vv Check for unusual IKE traffic patterns sudo tcpdump -i any udp port 500 or udp port 4500 -c 100 -1n | grep -i "length"
Remediation: Apply Microsoft’s April 2026 Patch Tuesday update. If immediate patching is not possible, block inbound UDP 500 and 4500 for systems that do not use IKE, or configure firewall rules to allow inbound traffic only from known peer addresses.
- The Bigger Picture: Patch Availability ≠ Patch Adoption
Despite vendors releasing patches for all four vulnerabilities weeks ago, exploitation continues unabated. This highlights a persistent and dangerous gap: patch availability does not equal patch adoption. The CISA KEV catalog serves as a reliable indicator of what adversaries are actively targeting.
Why This Matters: These vulnerabilities affect four distinct layers of enterprise infrastructure—OS (macOS), collaboration (SharePoint), virtualization (vCenter), and network authentication (IKE). An attacker exploiting any single flaw can achieve foothold, privilege escalation, lateral movement, or ransomware deployment. The combination of AI-enabled automation (DeepSeek-powered IKE exploitation) and nation-state APT activity (China-1exus vCenter backdoors) signals a new era of sophisticated, accelerated attack campaigns.
Immediate Recommended Actions:
- Validate patch levels for macOS, SharePoint, vCenter, and Windows IKE
- Review logs for authentication anomalies and unexpected remote access
- Audit vCenter for unauthorized binaries or reverse tunnels
4. Monitor for AI-driven automated exploitation patterns
- Enforce segmentation around management interfaces and remote services
What Undercode Say:
- Key Takeaway 1: The four vulnerabilities—spanning macOS Screen Sharing, SharePoint JWT validation, vCenter Syslog traversal, and Windows IKE double-free—represent a coordinated, multi-layer assault on enterprise infrastructure. The diversity of attack vectors (cryptominers, AI-driven APT, ransomware) demands a holistic, cross-domain defensive posture rather than siloed patching.
-
Key Takeaway 2: The geographic spread (361 IPs across 47 countries) and velocity of exploitation (PoC-to-exploit in days) underscore that attackers are faster than ever. Organizations that rely solely on monthly patch cycles are dangerously exposed. Continuous vulnerability management, real-time threat intelligence integration, and proactive log monitoring are no longer optional—they are existential requirements.
Analysis: The inclusion of CVE-2026-33824 (IKE) and CVE-2026-55040 (SharePoint) in the KEV catalog is particularly concerning because both involve AI-assisted discovery or exploitation. Rapid7 used an AI agent across 96 research sessions and ~80,000 tool calls to chain SharePoint flaws into a pre-auth RCE path. Meanwhile, the Chinese-speaking threat actor exploiting the IKE flaw simultaneously runs an AI-enabled autonomous hacking campaign using DeepSeek. This marks a paradigm shift: AI is no longer just a defensive tool—it is being weaponized at scale to accelerate vulnerability discovery, exploitation, and campaign orchestration. Defenders must respond with equal velocity: automated detection, AI-enhanced log analysis, and real-time threat hunting are no longer nice-to-haves.
Prediction:
- -1 The four KEV additions will trigger a cascade of follow-on attacks within 30 days. Expect ransomware operators to incorporate the vCenter and SharePoint flaws into automated exploit frameworks, targeting mid-sized enterprises with slower patch cycles. The IKE flaw, being network-accessible and requiring no authentication, will become a favorite entry point for botnet recruitment and cryptojacking campaigns.
-
-1 AI-enabled autonomous hacking will accelerate. The DeepSeek-driven IKE exploitation campaign is likely a proof-of-concept for broader AI-powered attack automation. Within 12 months, we will see AI agents autonomously scanning for KEV-listed vulnerabilities, generating custom exploits, and orchestrating multi-phase intrusions with minimal human intervention—outpacing traditional signature-based defenses.
-
+1 CISA’s KEV catalog and BOD 26-04 mandate will drive faster federal patch adoption, creating a “rising tide” effect that pressures commercial enterprises to accelerate their own vulnerability management. This may finally shift the industry away from monthly patch cycles toward continuous, real-time update cadences.
-
-1 The geographic concentration of victims in Germany, the U.S., Turkey, Iran, and France suggests targeted, strategic campaigns rather than opportunistic scanning. Expect nation-state actors to leverage these flaws in espionage operations against critical infrastructure, particularly energy and manufacturing sectors. Organizations in these regions should treat this as a high-priority, immediate threat requiring executive-level attention and accelerated remediation timelines.
▶️ Related Video (86% Match):
https://www.youtube.com/watch?v=-glKSQAfxiA
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eBMCRzeu – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
